rcp-ndcg

{"schema_version":"1.7.4","id":"MAL-2026-18658","published":"2026-11-05T03:31:09Z","modified":"2026-11-08T10:13:03.672189985Z","summary":"Malicious code in rcp-ndcg (PyPI)","details":"\n---\n_-= Per source details. Do not edit below this line.=-_\n\n## Source: amazon-inspector (9477dba93cdb5c9d325a028365bb7c4667531c8ac9e08d563e6a9573fae86809)\nrcp-ndcg 9999.0.0 is a dependency-confusion proof-of-concept squatting an unclaimed name referenced by cohere-ai's rcp-ndcg README, using an implausibly high version (9999.0.0) to win resolution against any internal package of that name. setup.py performs socket.getaddrinfo() to rcp-ndcg-build.<token>.oast.site at sdist build time, and src/rcp_ndcg/__init__.py performs a sibling getaddrinfo() to rcp-ndcg-import.<token>.oast.site on import. Both subdomains resolve through Interactsh (oast.site), a third-party out-of-band DNS collector controlled by the publisher, so each install and each import leaks the event and the resolver's IP to that collector. The package ships no legitimate functionality; its only observable behavior is the beacon. The sdist builds on all listed default platforms, so a plain `pip install rcp-ndcg` triggers the install-time callback, and any later `import rcp_ndcg` triggers the import-time callback.\n\n## Source: kam193 (5aa5f39fdbcfd160716eebb87c6bb303d9d6e08eb1beacee5a9a90f228fe7fff)\nInstalling the package or importing the module exfiltrates basic information about the host, and the package has no other purpose.\n\n\n---\n\nCategory: PROBABLY_PENTEST - Packages looking like typical pentest packages, but also anything that looks like testing, exploring pre-prepared kits, research & co, with clearly low-harm possibilities.\n\n\nCampaign: GENERIC-standard-pypi-install-pentest\n\n\nReasons (based on the campaign):\n\n\n - The package contains code to exfiltrate basic data from the system, like IP or username. It has a limited risk.\n\n\n - The package overrides the install command in setup.py to execute malicious code during installation.\n\n## Source: ossf-package-analysis (fc78014eaba6dbdc0a485f1954874cbfa65b71ffcda55b1b9337807004e42a2f)\nThe OpenSSF Package Analysis project identified 'rcp-ndcg' @ 9999.0.0 (pypi) as malicious.\n\nIt is considered malicious because:\n\n- The package communicates with a domain associated with malicious activity.\n","affected":[{"package":{"name":"rcp-ndcg","ecosystem":"PyPI"},"versions":["9999.0.0"],"database_specific":{"cwes":[{"cweId":"CWE-506","description":"The product contains code that appears to be malicious in nature.","name":"Embedded Malicious Code"}],"indicators":{"evidence_files":[{"artifacts":["rcp_ndcg-9999.0.0.tar.gz"],"path":"setup.py","sha256":"f8e4d2039b0404074c49deee39e102dd9210365b49d101fd89ff329dcfcb4ab5","tlsh":"1fe0c650ac3314e2c2c942c438b841c34e32c6827b0688ea62eec3a4234f232e128647"},{"artifacts":["rcp_ndcg-9999.0.0.tar.gz"],"path":"src/rcp_ndcg/__init__.py","sha256":"df0b196e0ec1bf851bfe806ecbd03d55f53a16b35eeefc29f0459349418b423c","tlsh":"bc21ce3fd4206ff03b8dc6da25a5122d461ea997a3310751358cdedc0f0ed1a612132f"}],"package_integrity":[{"filename":"rcp_ndcg-9999.0.0.tar.gz","hashes":{"blake2b_256":"584dcf7dbb238663360b434553bf97d66a355f4cbbd0d4cc2896df22eb7ea3e7","md5":"c2af72f8f12b0c5ee0b77bf08fb4cda1","sha256":"7ac297b25def5a2bee7113bdd6eaf99515cb4b1a177ef48c251b5e67fd1010c1"}}]}}}],"references":[{"type":"WEB","url":"https://bad-packages.kam193.eu/pypi/package/rcp-ndcg"},{"type":"PACKAGE","url":"https://pypi.org/project/rcp-ndcg/9999.0.0/"}],"database_specific":{"malicious-packages-origins":[{"import_time":"2026-11-05T03:37:47.501815253Z","modified_time":"2026-11-05T03:31:09Z","sha256":"fc78014eaba6dbdc0a485f1954874cbfa65b71ffcda55b1b9337807004e42a2f","source":"ossf-package-analysis","versions":["9999.0.0"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/rcp-ndcg","import_time":"2026-11-05T11:11:32.346437656Z","modified_time":"2026-11-05T10:58:48.424081Z","sha256":"5aa5f39fdbcfd160716eebb87c6bb303d9d6e08eb1beacee5a9a90f228fe7fff","source":"kam193","versions":["9999.0.0"]},{"id":"pypi/GENERIC-standard-pypi-install-pentest/rcp-ndcg","import_time":"2026-11-05T11:37:01.685170437Z","modified_time":"2026-11-05T10:58:48.424081Z","sha256":"22e82c48f7c25538d2d035470934b938082c61a0488c803ecc4ee14a6868f4a7","source":"kam193","versions":["9999.0.0"]},{"id":"IN-MAL-2026-022571","import_time":"2026-11-08T10:11:09.494676952Z","modified_time":"2026-11-08T09:40:32Z","sha256":"9477dba93cdb5c9d325a028365bb7c4667531c8ac9e08d563e6a9573fae86809","source":"amazon-inspector","versions":["9999.0.0"]}]},"credits":[{"name":"Amazon Inspector","contact":["inspector-research@amazon.com"],"type":"FINDER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"REPORTER"},{"name":"Kamil Mańkowski (kam193)","contact":["https://github.com/kam193","https://bad-packages.kam193.eu/"],"type":"ANALYST"},{"name":"OpenSSF: Package Analysis","contact":["https://github.com/ossf/package-analysis","https://openssf.slack.com/channels/package_analysis"],"type":"FINDER"}]}